Banking, Wallet and NFC payment: alternative operating systems want to break away from Google
Google-free Android versions offer more data protection, but Google can exclude them from functions such as banking apps, digital wallets or NFC payments. A new standard aims to change this.
Multiple suppliers of Google-free operating systems have joined forces to create a new standard. This is intended to provide proof of security requirements for sensitive apps. For example, for banking, proof of identity or digital wallets.
New standard against Google as gatekeeper
With Volla, Apostrophy, Iodé and /e/OS - more precisely the e.foundation and Murena - several suppliers have joined forces. They want to create a new security standard that enables their devices to run very sensitive applications.
The consortium members' offerings are based on the Android Open Source Project (AOSP). Other Google-free operating systems should also be able to use the new standard. Other - unnamed - manufacturers from Europe and Asia are said to have expressed their interest.
Source: Volla
The current global political situation could accelerate support from European politicians. Publishers of government apps in Scandinavia are already looking into whether they can use the new process, Volla reports in a press release.
Google Play Integrity as a problem
«Google Play Integrity» is the name of the service for Android that tells developers whether an app is running on a device with certain security requirements. Only devices with a direct Google connection receive the highest of the three security levels.
Alternative operating systems such as /e/OS, Apostrophy or GrapheneOS can therefore not prove that they fulfil all the requirements of an application. They have to do without important apps and convenient functions such as mobile payment or digital tickets.
UnifiedAttestation as a transparent and secure solution
Work on the new standard has begun under the project name «UnifiedAttestation». Its modular architecture comprises three central elements:
- An operating system service that can be integrated into an app with just a few lines of code and indicates whether the operating system fulfils the required security requirements.
- a decentralised validation service for checking the validity of operating system certificates
- an open test suite
Source: Volla
The consortium members test and certify each other's smartphones and tablets in a peer review process. This is intended to create transparency and trust. The software is to be published open source under the Apache 2.0 licence - commercial use is therefore free of charge.
Practical use is still a long way off
The project is still in its infancy: technical implementation has only just begun and there is no public timetable. Even when the system is in place, publishers will still have to adapt their apps. It will therefore be some time before banking apps can be used under /e/OS or boarding passes under Iodé.
GrapheneOS, an important Google-free Android variant, is not mentioned. It is currently unclear whether his team will join the standard. Experience has shown that it pays very close attention to the technological implementation in order to ensure the integrity and security of its software.
As a primary school pupil, I used to sit in a friend's living room with many of my classmates to play the Super NES. Now I get my hands on the latest technology and test it for you. In recent years at Curved, Computer Bild and Netzwelt, now at Digitec and Galaxus.
From the latest iPhone to the return of 80s fashion. The editorial team will help you make sense of it all.
Show all